CVE-2015-5260: Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-...

Security readout for executives and security teams

This flaw affects SPICE before 0.12.6 in virtualized environments. A user inside a guest VM could crash the QEMU-KVM host process and may be able to execute code on the host. Business urgency depends on whether SPICE/QXL is enabled and whether guest users are trusted. Most relevant to virtualization hosts using SPICE/QXL graphics, especially where guest OS users are untrusted or multi-tenant. Systems not running SPICE before 0.12.6, or not exposing SPICE/QXL to guests, are less likely to be exposed based on the provided evidence. Prioritize remediation on virtualization infrastructure where guest users are not fully trusted. The main confirmed risk is host service disruption, with possible host code execution noted by the CVE. Patch through normal vendor channels and track any hosts that cannot be updated promptly. Mitigation focus: Upgrade SPICE to 0.12.6 or later where applicable.; Apply fixed vendor packages from Red Hat, Debian, Ubuntu, Gentoo, or Oracle advisories.; Prioritize hosts running untrusted or multi-tenant guest workloads..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.